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1  ABSTRACT 

This  paper  briefly  describes  the  main  methodologies  used  in  the  assessment  of  fracture  critical  parts.  The 
development  of  a procedure  for  the  quantitative  assessment  of  non-finite  results  is  discussed  and  typical 
life  extension  levels  are  illustrated.  Risk  assessment  is  considered  within  the  context  of  the  safe  life 
methodology.  It  is  used  to  quantify  the  potential  risks  associated  with  the  short-term  continued  operation 
of  life-expired  parts  and  to  allow  their  managed  withdrawal.  The  paper  then  considers  risk  assessment 
applied  to  the  damage  tolerance  and  retirement  for  cause  life  assessment.  The  significance  benefits  of 
risk  based  inspections  intervals  over  standard  fixed  inspections  are  illustrated.  Finally  with  regard  to 
retirement  for  cause,  it  is  shown  that  a risk  based  approach  automatically  sets  an  economical  limit  to 
retirement  for  cause  but  avoids  the  progressive  risk  levels  associated  with  the  current  embodiment. 


2  BACKGROUND 

Aeroengine  components  are  classified  into  fracture  ‘critical’  or  ‘non-critical’  depending  on  the 
consequences  that  a malfunction  might  have  on  the  integrity  of  the  aircraft.  Turbine  and  compressor  discs 
and  shafts  are  identified  as  the  major  fracture  critical  components.  They  experience  extreme  thermo- 
mechanical transient  loadings,  which,  in  the  absence  of  an  adequate  life  prediction  policy,  eventually  lead 
to  low  cycle  fatigue  (LCF),  creep  or  corrosion  failures.  Since  it  is  not  practical  to  design  engine  casings 
capable  of  containing  such  events,  it  is  essential  to  ensure  that  their  occurrence  in  service  is  an  extremely 
remote  possibility.  Hence  a fundamental  requirement  of  both  military  and  civil  for  engine  certification  is 
therefore  to  ensure  the  continued  airworthiness  and  integrity  of  fracture  components  such  as  discs  and 
shafts  throughout  their  service  operation.  Such  events  are  non-random  and  hence  as  service  operation 
progresses,  both  the  risk  of  failure  and  the  rates  at  which  risks  accumulate  rise  rapidly. 

In  earlier  times,  prior  to  aircraft  reaching  their  full  declared  lives,  the  introduction  of  next  generation 
aircraft  led  to  fleet  withdrawal  prior  to  many  major  components  becoming  life  expired.  This  is  certainly 
no  longer  the  case  and  lifing  methodologies  must  ensure  that  thoughout  the  declared  service  lives  of  the 
componentsjhejikelihood  of  failure  is  extremely  remote.  Within  the  U.K.,  the  inclusion  of  a requirement 
to  fatigue  test  ex-service  discs  has  significantly  reduced  the  risk  of  the  unforeseen.  The  current  pape-r  will 
review  briefly  the  major  methodologies  applied  to  meet  these  requirements.  Additionally,  it  will  illustrate 
the  concepts  and  application  of  several  methods  which  allow  safe  life  extension.  Within  the  general 
context  of  Damage  Tolerance,  the  benefits  of  risk  based  inspection  intervals  over  conventional  procedures 
will  be  demonstrated. 


3  LIFE-TO-FIRST-CRACK 

Under  current  UK  Military  Defence  Standards  (Def.  Stan.  00-971)  [1]  and  European  Civil  Joint 
Airworthiness  Requirements  (JAR-E)  [2],  the  service  lives  for  fracture-critical  components  are  derived 
from  spin-rig  test  results  of  actual  engine  discs  under  cyclic  loading  at  stress  and  temperature  conditions 
similar  to  those  experienced  in  engine  operation.  These  regulations  are  based  on  a safe-life  policy  wherein 
component  fatigue  ‘failure’  is  defined  as  the  occurrence  of  an  ‘engineering  crack’  of  0.38mm  radius. 


Paper  presented  at  the  RTO  A VT  Specialists  ’ Meeting  on  "Life  Management  Techniques  for  Ageing  Air  Vehicles  ”, 
held  in  Manchester , United  Kingdom,  8-11  October  2001,  and  published  in  RTO-MP-079(II). 
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If  the  total  fleet  dysfunction  distribution  were  known  i.e.  all  components  were  tested  to  failure,  the  mean 
dysfunction  life  would  be  known  exactly.  In  practice  a sample  is  selected  from  this  distribution  and 
tested  until  significant  crack  growth  or  burst.  The  mean  life  for  the  sample  provides  an  estimate  of  the 
mean  life  of  the  rest  of  the  fleet. 

A consequence  of  the  high  cost  of  disc  spin  testing  is  that  it  is  only  practical  to  test  a very  small  sample  of 
the  discs.  Hence  such  tests  are  extremely  expensive  and  few  results  are  available,  dealing  with  the 
probabilistic  nature  of  fatigue  is  an  essential  part  of  any  life  assessment.  To  address  the  statistical 
difficulties  associated  with  small  sample  sizes,  the  lifing  regulations  define  the  procedures  for  the  safe 
interpretation  of  these  results  and  for  the  calculation  of  the  declared  service  lives.  Certain  assumptions 
have  therefore  to  be  made  concerning  the  statistical  form  of  the  dysfunction  population  distribution. 
From  past  UK  experience  the  failure  distribution  is  assumed  to  be  lognormal  and  significantly  the 
assumption  is  also  made  that  the  scatter  associated  with  the  distribution  is  also  known.  It  is  therefore 
assumed  that  the  ratio  in  life  (scatter)  between  the  +3o  and  - 3a  quantiles  (749/750  and  1/750)  is  known. 
This  assumption  has  major  implications  regarding  the  analysis  performed  on  the  test  sample.  Hence  the 
mean  life  from  a small  sample  used  as  an  estimate  of  the  population  mean  life  will  only  be  approximate, 
provided  that  the  population  scatter  factor  is  known,  for  any  test  sample  taken  from  the  population  the 
sampling  error  must  be  established  absolutely.  For  example,  if  the  whole  of  the  population  was  randomly 
split-up  into  samples  of  any  specified  size  (e.g.  5),  tested,  and  the  mean  lives  from  all  the  samples  plotted, 
the  distribution  that  would  be  obtained  can  be  predicted  statistically  without  any  testing.  Hence  by 
associating  the  known  distributions  to  the  actual  test  sample,  the  magnitude  of  the  sampling  error  is  also 
known.  In  other  words  from  the  mean  life  of  the  test  sample  the  population  mean  life  can  be  established 
to  any  required  level  of  confidence  e.g.  95%.  Also  if  the  mean  life  of  the  population  is  known,  the  mean 
life  to  any  other  quantile  is  also  known. 

This  is  the  basis  of  the  UK  statistical  models  applied  to  both  (Life  to  First  Crack)  ltfc  and  to  the 
dysfunction  distribution. 

Having  established  the  burst  distribution,  risk  assessment  is  about  identifying  where,  at  any  specific  time, 
individual  discs  in  service  lie  relative  to  the  failure  distribution.  In  practice,  it  is  easier  to  attach  the  error 
function  to  these  points  rather  than  the  full  burst  distribution  but  in  statistical  terms  the  effects  are 
identical.  The  statistical  model  is  the  same  as  that  applied  in  ltfc  and  2/3  dysfunction  approaches.  That 
is,  a predicted  safe  cyclic  life  (PSCL)  is  calculated  by  applying  statistically-derived  safety  factors  to  the 
geometric  mean  (GM)  of  the  respective  test  results,  such  that  at  this  life,  not  more  than  1 in  750  service 
discs  would  be  expected  to  contain  an  ‘engineering  crack’,  to  95%  confidence.  It  is  from  this  base  that  the 
life-extension  procedures  discussed  in  the  paper  are  quantitatively  assessed. 

Experience  has  shown  that  typically  disc  fatigue  lives  are  distributed  according  to  a lognormal  density 
function.  Also  the  assumption  is  made  that  the  ratio  of  the  fatigue  lives  at  the  +30  and  -30  points  on  the 
life-to-first-crack  (ltfc)  distributions  is  6.  Given  an  assumed  scatter  factor  of  6,  the  life  corresponding  to 
the  lower  1/750  quartile  is  automatically  located  at  a factor  of  3 standard  deviations  (i.e.Vb  (=-2.449)) 
below  the  geometric  mean  (GM)  ltfc  obtained  from  the  sample.  A 95%  confidence  level  allows  for  the 
effect  of  component  test  sampling  error  on  the'safety  level  inherent  in  the  calculation.  This  lower 
-confidence  bound  corresponds  to  a safety  factor  in  life  of: 


where  the  95%  confidence  corresponds  to  1.645  standard  deviations.  The  combined  safety  factor  y is 
given  by  the  expression 


y = 


(2) 


Finally,  a predicted  safe  cyclic  life  (PSCL)  or  Ar  is  obtained  by  dividing  the  log  mean  test  cycles 
(converted  to  equivalent  reference  cycles)  by  the  factor  y. 
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y 


(3) 


where  ‘Ni,’  are  the  individual  ltfc  test  results.  It  can  be  seen  that  equation  2 is  an  increasing  function  with 
respect  to  decreasing  sample  size.  Application  of  factors  involved  in  determining  ‘Ar’  is  illustrated  in 
Figure  1. 

Stress  <t 


Figure  1.  Derivation  of  the  material  design  curve  and  predicted  safe  cyclic  life. 

Through  using  an  ‘engineering  crack’  as  the  basis  for  the  calculation,  the  additional  life  taken  to  grow  to 
the  critical  size  associated  with  dysfunction  (failure)  acts  as  a further  margin  of  safety.  Ultimately,  it  is 
this,  in  combination  with  the  factors  in  the  denominator  of  equation  2 which  define  the  actual  safety  level 
inherent  in  the  application  of  this  method. 


4 LIFE  REVISION  OF  AGEING  ENGINES 

A consequence  of  the  high  cost  of  disc  spinning  tests  is  that  once  a specified  (required)  design  life  has 
been  demonstrated,  there  is  great  pressure  to  discontinue  the  respective  test  programme,  even  though  the 
discs  have  not  reached  ‘failure’  (defined  as  the  occurrence  of  an  engineering  crack).  Results  of  this  kind 
are  called  ‘non-finite’.  Non-finite  results  can  also  arise  for  several  other  reasons.  Amongst  these,  a 
common~cause  is  a change  itvthe  identified  failure  location  within  a component  as  the  result  of  either  ' 
service  experience  or  reanalysis  of  the  basic  design.  The  current  lifing  regulations  were  originally 
derived  to  accept  only  finite  results  and  this  has  caused  non-finite  results  to  be  either  rejected 
unnecessarily  or  accepted  overconservatively  by  assuming  ‘failure  on  the  next  load  cycle’.  The  corollary 
is,  that  where  the  newly  established  failure  location  is  now  identified  as  having  experienced  little  or  no 
overstress,  the  service  life  that  can  now  be  declared  would  need  to  be  reduced  by  a factor  of  up  to  4, 
depending  on  the  number  of  test  results  available. 

4.1  Improved  statistical  analysis  of  non-finite  results 

In  the  current  paper  an  analysis  methodology  for  samples  comprising  of  only  non-finite  results,  is 
illustrated.  However,  in  addition,  the  general  methodology  can  also  handle  samples  comprising  of  mixed 
finite  and  non-finite  data.  To  illustrate  the  principles,  in  the  following  analysis  it  is  assumed  that  the 
results  belong  to  a lognormal  ltfc  distribution  having  a known  scatter  factor.  As  is  the  case  for  samples  of 
finite  results,  the  geometric  mean  (GM)  of  the  population  ltfc  distribution  is  estimated  to  95%  confidence. 
Once  this  value  is  obtained,  the  1/750  (-3o)  quantile  is  selected  to  provide  a safety  factor  to  give  a value 
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for  the  required  safe-service  life,  Ar,  (cycles).  To  identify  a conservative  confidence  interval,  the 
probability  of  obtaining  a non-finite  result  at  Nf  cycles  is  established  based  on  a given  value  of  the  GM 
(the  minus  superscript  indicates  that  the  value  is  non-finite). 

A 95%  lower  confidence  bound  for  the  true  GM  can  be  obtained  by  identifying  that  mean  value  for  which 
the  probability  of  a component  not  surviving  N'  cycles  is  5%.  That  is,  there  is  a 95%  chance  that  the 
defined  likelihood  lies  within  the  interval  0.05  to  1 . Therefore,  given  the  value  of  N'  , a 95%  lower 
confidence  bound  for  GM  can  be  obtained  when  the  following  equation  is  satisfied. 

p(non  - finite  at  N cycles)  = 0.05  (4) 


As  the  sample  size  is  equal  to  one,  this  confidence  bound  leads  to  the  same  formula  as  would  apply  if  the 
result  were  finite.  For  a sample  of  size  ‘n’  the  confidence  test  generalises  to 


p{non  - finite  at  Nj  cycles ) = 0.05  (5) 

j= l 


That  is,  the  probability  of  obtaining  all  non-finite  results  is  equal  to  the  product  of  the  probabilities  of 
obtaining  the  individual  non-finite  results  in  the  sample.  As  for  a sample  of  size  one,  a confidence 
interval  on  the  GM  is  chosen  such  that  the  probability  of  obtaining  the  sample  is  equal  to  a value  lying 
between  0.05  and  1.  Thus,  a conservative  95%  lower  confidence  bound  for  the  GM  is  given  as  that  value 
for  which  this  product  is  equal  to  0.05  (see  equation  4).  This  equation  embodies  a ‘next-cycle-failure’ 
assumption  for  up  to  one  of  the  non-finite  results.  It  is  still  slightly  overconservative  since  the  probability 
of  even  one  of  the  non-finite  results  reaching  dysfunction  on  its  next  cycle  is  extremely  low.  However,  in 
general,  removal  of  this  overconservatism  is  complex  and  (without  further  information)  does  not  result  in 
a significant  life  increase. 

It  remains  to  substitute  an  expression  for  the  failure  distribution  into  equation  4.  Firstly  a change  of 
variable  is  applied  such  that  the  parameter  N/  is  the  resulting  non-finite  value  associated  with  test  result  J, 
expressed  in  its  logarithmic  form,  divided  by  the  geometric  mean  life,  NM,  and  rescaled  to  units  of 
standard  deviation.  (Division  by  the  population  geometric  mean  life,  NM,  has  the  effect  of  placing  the 
origin  at  the  population  GM  life  which  has  an  indeterminate  fixed  value.)  The  following  solution  is 
obtained: 


n 


j=i 


log 


1 - normal 


( - \ ^ 
95% 

v 'V 


61oS 


N 


+3(7 


= 0.05 


(6) 


where  the  W’5%  value  is  a 95%  confidence  estimate  of  the  GM  of  the  population  fatigue  life  distribution. 

This  is  the  only  unknown  in  equation  6,  and  hence  can  be  solved  by  substitution  of  the  known  values  and 
iteration  until  the  equation  is  satisfied. 

Once  AT5'”  has  been  established,  the  standard  safety  factor  can  be  applied  (as  illustrated  in  equation  2)  to 
ensure  that  not  more  than  1/750  components  reach  the  defined  dysfunction  point.  That  is. 


Ar  = N 


95% 
-3  a 


(7) 
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By  way  of  illustration,  the  application  of  the  above  expression  to  5 non-finite  results  of  10,000  cycles 
gives  N9/'°  =10,374  cycles  and  substitution  of  this  value  in  equation  7 gives  an  Ar  value  of  4,235  cycles. 

Thus,  in  this  example  and  without  any  compromise  to  safety,  the  improved  statistical  analysis  supports  a 
29%  increase  in  the  service  life  relative  to  that  declared  via  current  regulations.  In  service,  the  life 
extensions  given  by  the  method  have  ranged  between  5%  and  50%. 

At  one  extreme  a sample  may  contain  all  finite  results;  at  the  other  all  non-finite  results.  Consistency 
between  the  solution  for  mixed  results  and  these  two  extremes  can  be  demonstrated.  Firstly  for  mixed 
results  the  solution  copes  with  cases  where  all  the  results  in  the  sample  are  finite  and  hence  the 
confidence  test  used  for  the  analysis  of  all  finite  results  gives  exactly  the  same  results  as  that  developed 
for  samples  of  totally  finite  results.  There  is  a subtle  difference  in  that  this  confidence  test  uses  a change 
of  variable  to  a logarithmic  normal  density  functional  form  as  the  reference  datum,  whereas  the  earlier 
test  uses  the  mean  of  the  sample  as  the  reference  datum.  However,  as  this  difference  does  not  change  the 
statistical  model,  it  makes  no  difference  to  the  solution.  For  illustration,  at  the  other  extreme  (mostly  non- 
finite)  when  all  the  results  in  the  sample  have  the  same  life  and  all  but  one  is  non-finite,  then  the  mixed 
results  confidence  test  yields  the  same  equation  as  is  used  in  the  all  non-finite  case.  It  can  therefore  be 
verified  that  there  is  complete  consistency  between  the  solutions  for  samples  of  mixed  results  and  for 
samples  of  all  finite  results.  Also,  there  appears  to  be  a consistent  level  of  conservatism  between  the 
solution  for  samples  of  all  non-finite  results  and  the  solution  for  samples  of  mixed  results.  The 
confidence  test  used  in  the  well-established  method  for  handling  samples  of  all  finite  results  is  fully 
optimised.  However,  as  discussed  above,  the  confidence  test  for  samples  of  mixed  results  is  essentially  a 
more  generalised  version  of  that  used  to  handle  samples  of  all  finite  results.  Thus,  this  is  also  fully 
optimised. 

Finally,  for  a sample  of  non-finite  results,  a different  confidence  test  has  to  be  used.  The  one  currently 
demonstrated  is  marginally  overconservative  for  two  reasons.  Firstly,  the  additional  complexity  required 
to  exploit  fully  the  non-finite  results  is  probably  not  justified  in  terms  of  the  small  increase  in  life  it  would 
give.  Secondly,  it  enables  the  approach  to  be  related  to  the  familiar  'minimum  life  formula'  and  the 
Weibayes  formula.  This  is  important  for  verification  of  the  theory. 

The  solution  for  mixed  results  is  well  behaved  between  the  extremes  of  all  finite  and  all  non-finite  results. 
One  way  of  demonstrating  this  is  to  compare  the  variation  of  the  safe  service  life  as  a function  of  the 
proportion  of  the  results  in  the  sample  which  are  non-finite.  For  example  for  the  sample  of  5 results  all  of 
10,000  cycles  that  were  considered  above,  as  the  sample  moves  from  all  finite  to  only  one  finite  result,  the 
available  safe  life  increases  as  illustrated: 


No.  of  Finite  Results 

No.  of  Non-Finite  Results 

PSCL  (cycles) 

4 

1 

4,235 

3 

2 

3,857 

2 

3 

3,611 

1 

4 

3,427 

0 

5 ' 

3,278 

Table  1 Influence  of  non-finite  results  on  predicted  safe  cyclic  life.  (All  tests  discontinued  at  10,000 
cycles). 


Although  somewhat  obvious,  the  lower  the  value  of  a non-finite  result;  the  less  its  significance. 
However,  this  property  allows  a further  verification  of  the  mixed  results  methodology  (see  Table  1).  For 
example,  suppose  there  is  a sample  of  2 results  one  has  a finite  value  of  10,000  cycles  and  the  other  a 
non-finite  value  of  10,000  cycles.  Then  a safe  service  life  of  3,254  cycles  is  given  by  the  methodology 
(see  row  1 of  the  Table  2).  Suppose  instead  the  non-finite  value  of  the  second  result  is  8,000  cycles,  then 
a safe  life  of  3,000  is  given  (see  row  2 of  Table  2).  This  calculation  is  repeated  with  successively  smaller 
values  for  the  second  result.  As  expected,  eventually  the  safe  life  converges  on  a value  of  2,498  cycles 
(the  same  value  as  if  the  second  result  did  not  exist  at  all). 


First  Test  Result 
(cycles) 

Second  Test  Result 
(cycles) 

Predicted  Safe  Cyclic  Life  (cycles) 

10,000  f. 

10,000  n.f. 

3,254 

10,000  f. 

8,000  n.f. 

3,000 

10,000  f. 

6,000  n.f. 

2,752 

10,000  f. 

4,000  n.f. 

2,556 

10,000  f. 

2,000  n.f. 

2,499 

10,000  f. 

1,000  n.f. 

2,498  (convergence) 

Table  2.  Influence  of  low  non-finite  results  on  predicted  safe  cyclic  lives  (samples  of  2) 


A further  example  of  the  capability  of  the  methodology  to  handle  low  non-fmite  results  as  expected  is 
given  in  Table  3,  this  time  using  a sample  size  of  3. 


First  Test  Result 
(cycles) 

Second  Test  Result 
(cycles) 

Third  Test  Result 
(cycles) 

Predicted  Safe  Cyclic 
Life  (cycles) 

10,000  f. 

10,000  n.f. 

10,000  n.f. 

3,693 

10,000  f. 

10,000  n.f. 

8,000  n.f. 

3,505 

10,000  f. 

10,000  n.f. 

6,000  n.f. 

3,346 

10,000  f. 

10,000  n.f. 

4,000  n.f. 

3,264 

10,000  f. 

10,000  n.f. 

2,000  n.f. 

3,254 

10,000  f. 

10,000  n.f. 

1,000  n.f. 

3,254 

Table  3.  The  influence  of  lower  non-finite  results  on  predicted  safe  cyclic  lives  ( sample  size  3) 
Further  examples,  comparing  mixed  samples  of  size  3. 


As  for  any  lifing  calculation,  safe  application  of  the  non-fmite  methodology  depends  on  the  validity  of  the 
assumptions  made.  Primarily  this  means  that  the  assumed  scatter  factor  (i.e.  the  factor  in  life  between  the 
plus  and  minus  3ct  points  on  the  population  failure  distribution)  must  be  conservative.  Wherever  possible 
a Chi-squared  test  should  be  undertaken  verify  that  the  assumed  population  scatter  is  consistent  with  that 
associated  with  the  sample.  In  dealing  with  non-fmite  results,  via  an  inequality  condition  a lower  bound  is 
established  for  the  finite  value  associated  with  the  non-finite  result. 

4.2  2/3  Dysfunction  failure  criterion 

Experience  over  many  years  has  shown  that  the  ltfc  approach  is  very  conservative  and  disc  failures  in 
service  are  extremely  remote  with  rates  of  only  one  or  two  for  every  100  million  flying  hours.  The 
approach  has  an  in-built  factor  of  safety  associated  with  the  cycles  required  to  grow  a crack  from  0.78mm 
to  the  dysfunction  crack  size.  Since  this  value  is  both  material  and  geometry  dependent,  the  method  does 
not  provide  an  overall  quantifiable  level  of  safety.  To  address  this,  an  extension  of  this  approach,  the 
crack  initiation  life  has  been  replaced  by  a set  fraction  of  the  total  cycles  to  dysfunction.  A figure  of 
‘two-thirds’  has  been  established  in  the  UK  and  increasingly  throughout  Europe. 

RB199  engine  for  which  it  has  been  shown  that  crack  propagation  (3-factors  can  be  2-3  times  greater  than 
crack  initiation  (3-factors  [3].  In  this  paper,  we  consider  a typical  case  in  which  (3p/(3j=2.5. 

4.3  Crack  tolerant  designs 

In  crack  tolerant  designs,  components  have  2/3  dysfunction  lives  that  can  be  significantly  greater  than 
those  established  via  ltfc.  This  difference  represents  an  additional  safe  crack  growth  phase  which  can  be 
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exploited.  Assessments  of  life-limiting  areas  such  as  drive  arm  vent  holes  and  disc  rim  features  are 
typical  of  design  features  that  can  exhibit  significant  crack  tolerance. 

For  such  crack  tolerant  components,  service  lives  can  be  safely  extended  beyond  100%  Ar,  without 
exceeding  the  extremely  remote  risk  levels  associated  with  conventional  failure  locations.  However,  to 
ensure  a consistent  level  of  safety,  the  associated  ‘never  exceed’  2/3  dysfunction  margin  of  safety  must  be 
imposed  on  the  useable  crack  growth  life.  Thus,  relative  to  component  lives  based  on  ltfc,  life  extension 
is  available  when  the  crack  growth  life  is  greater  than  50%  of  the  ltfc  value.  To  ‘cash  in’  the  benefits  of 
such  designs,  it  is  necessary  to  be  able  to  predict  accurately  this  crack  growth  phase  and  hence  it  is 
necessary  to  apply  fracture  mechanics  procedures  based  on  establishing  operating  stress  intensity  levels. 

Although  service  lives  are  expressed  in  terms  of  the  major  reference  cycles  experienced,  the  damage 
induced  by  the  large  number  of  minor  cycles  must  also  be  accounted  for.  Minor  cycles  occur  as  a result 
of  adjustments  to  the  thrust  requirements  during  various  stages  of  the  mission  flown  by  the  aircraft. 
These  are  accounted  for  as  the  additional  number  of  reference  cycles  per  hour  of  flight  that  would  inflict 
equivalent  damage  to  one  hour  of  the  minor  cycle  loading.  Then  the  exchange  rate  [1  is  defined  as  the 
total  number  of  reference  cycles  (major  and  minor)  consumed  during  one  hour  of  flight. 

Both  theoretical  analyses  and  experimental  test  programmes  have  shown  that,  under  an  identical  mission 
loading  sequence,  minor  cycles  are  relatively  more  damaging  during  crack  propagation  than  during  the 
ltfc  initiation  stage.  This  can  be  explained  in  terms  of  the  difference  in  the  stress  exponents  associated 
with  the  life-to-first-crack  curve  and  with  the  stress  intensity  exponents  associated  with  the  crack  growth 
curve.  Below  the  fatigue  endurance  limit,  minor  sub-cycles  have  virtually  no  influence  on  crack 
initiation,  however  they  can  contribute  during  the  propagation  phase.  For  the  crack  initiation  phase  (ltfc), 
a weighted  average  consumption  rate  of  reference  cycles  per  engine  flying  hour,  pi  must  be  established. 
Similarly,  during  crack  propagation  a is  the  weighted  average  consumption  rate  of  reference  cycles  per 
engine  flying  hour,  PP,  must  also  be  established.  A consequence  of  crack  initiation  and  crack  propagation 
models  is  that  Pp  is  generally  greater  than  Pi.  And  typically,  Pp/Pi  has  a value  equal  to  2.5.  These 
observations  have  been  confirmed  recently  for  the  Tornado  aircraft. 

Although  life  consumption  and  remnant  life  calculations  are  evaluated  in  terms  of  reference  cycle 
damage,  the  end  user  is  interested  in  the  service  hours  available  for  specific  components.  In  general  to 
get  this  information,  it  is  simply  a matter  of  dividing  the  release  lives  (in  cycles)  by  the  relevant  p-factor. 
The  value  obtained  identifies  the  authorised  service  life  in  engine  flying  hours.  For  the  situation  in  which 
the  2/3  dysfunction  life  exceeds  the  ltfc,  this  difference  in  reference  cycles  needs  to  be  divided  by  the 
propagation  p-factor  to  establish  the  authorised  additional  life  in  engine  flying  hours.  Extensions  of  about 
40%  have  been  demonstrated  for  RBI 99  IPC  and  IPT  rotor  components.  Details  of  the  procedures 
involved  in  determining  safe  crack  growth  lives  are  given  elsewhere  (AGARD)  [4]. 

4.3.1  Fracture  Mechanics  Based  Procedures 

A consequence  of  the  development  of  very  high  strength  disc  alloys  is  that  the  critical  crack  size  for  the 
onset  of  rapid  fatigue  crack  growth  can  be  smaller  than  the  0.78mm  associated  ltfc.  Additionally, 
aeroengine  discs  can  have  several  life  limiting  features  dependent  on  the  specific  design  and  operational 
requirements.  The  net  effect  is  that  it  is  impossible  to  construct  a common  databank  for  all  these  features 
on  an  ltfc  basis.  However  a rationalised  design  approach  can  be  developed  via  a fracture  mechanics 
approach.  In  such  cases,  it  is  assumed  that  failure  occurs  either  from  initiation  and  growth  of  cracks 
induced  by  the  imposed  service  loading  sequences  or  as  the  result  of  crack  propagation  from  inherent 
defects.  Currently  there  are  three  fracture  mechanics  based  life  assessment  methodologies  approved  for 
the  certification  of  aeroengine  fracture  critical  parts.  These  are  Databank  Lifing  [5],  Damage  Tolerance 
Lifing  and  Retirement-for-cause  [6],  The  first  approach  is  approved  for  use  in  UK  Civil  and  Military 
engines  and  the  others  apply  to  US  Military  engines. 

4.3.2  Databank  Life  Assessment 

This  procedure  assumes  that  all  discs  contain  small  “pseudo”  defects  that  grow  under  fatigue  loading  in  a 
predictable  manner  from  the  first  cycle.  For  the  various  features  for  which  failure  lives  and  final  crack 
lengths  are  known,  the  ‘Paris’  crack  growth  equation  is  used  in  a back  calculation  mode  to  determine  a 
“pseudo”  crack  size  present  in  the  component/test  piece  at  cycle  one.  Since  the  fracture  mechanics 
analysis  accounts  for  variations  in  component  geometry,  stress  field  and  crack  shape,  the  approach  offers 
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a means  of  combining  the  results  of  different  disc  designs  and  large  specimens  into  a common  data  bank. 
Statistical  analysis  procedures  define  the  maximum  effective  “pseudo”  crack  size  likely  to  be  present  in 
the  total  population.  This  initial  flaw  is  then  used  as  the  starting  point  in  a standard  Paris  summation  to 
calculate  the  maximum  allowable  service  life.  The  effective  initial  flaw  sizes  have  no  physical  meaning, 
they  simply  provide  a suitable  parameter  to  enable  the  lives  of  different  component  geometries  to  be 
combined  into  a common  data  set.  The  inverses  of  the  pseudo  crack  sizes  are  plotted  in  terms  of  a three- 
parameter  Weibull  model.  Accurate  estimates  of  component  life  can  be  established  at  the  design  stage 
thereby  allowing  greater  design  optimisation  and  more  effective  use  of  materials.  Both  CAA  and  FAA 
Airworthiness  Authorities  have  approved  fracture  mechanics  databank  methods  in  declaring  lives  of  civil 
engine  components. 

4.4  Damage  Tolerance  Life  Assessment  and  Retirement  for  Cause 

In  this  philosophy,  damage  is  again  assumed  to  pre-exist  in  newly  manufactured  components,  but  the 
starter  crack  size  for  residual  life  calculations  is  based  on  proven  NDE  capability.  The  residual  life  of  the 
component  is  determined  by  applying  a fracture  mechanics  approach  to  calculate  the  number  of  cycles 
required  to  grow  from  the  starter  crack  size  to  a critical  length.  By  assuming  that  damage  exists  in 
components  as  manufactured,  the  damage  tolerance  method  avoids  problems  associated  with  the 
statistical  distribution  of  crack  initiation.  Achievements  of  an  acceptable  level  of  safety  now  depends 
both  on  the  reliability  of  the  NDE  system  and  on  how  often  cracks  or  defects  of  a given  size  occur  in 
practice.  The  most  widely  applied  damage  tolerance  methodology  is  that  developed  by  the  US  Airforce 
under  its  Engine  Structural  Integrity  Programme  (ENSIP).  Here,  the  declared  service  life  is  based  on  an 
NDE  crack  detection  size  set  to  achieve  a detection  level  of  90%  with  95%  confidence.  Mean  crack 
growth  data  are  used  to  determine  the  available  growth  life  to  dysfunction  and  the  declared  safe  service 
life  is  normally  set  at  half  this  value. 

4.4.1  Retirement  for  Cause 

This  is  an  extension  of  the  damage  tolerance  approach  which  has  been  applied  to  high  performance 
military  components  in  the  U.S.  In  contrast  to  the  Itfc  method,  retirement  is  not  implemented  until  actual 
cracks  have  been  identified  in  individual  discs.  The  safety  of  the  approach  is  strongly  dependent  on  the 
effectiveness  of  the  NDE  technology. 


5 EXTENDED  COMPONENT  SERVICE  LIVES  VIA  RISK  ASSESSMENT  AND  RISK 
MANAGEMENT 

5.1  Risk  analysis 

In  the  safe  life  methodology,  the  predicted  safe  cyclic  life  of  a fracture-critical  component  is  set  to  ensure 
that  to  95%  confidence  not  more  than  1/750  service  components  suffer-an  engineering  crack  (>0.38mm 
radius).  However,  in  applying  this  definition  to  the  lifing  of  service  components,  several  limitations  have 
been  encountered.  Hence,  although,  ultimately  safety  should  be  concerned  with  ensuring  that  the 
possibility  of  fracture  critical  parts  failure  (dysfunction)  must  be  extremely  low,  the  risks  associated  with 
this  event  are  not  addressed  directly.  Also,  in  general,  the  declared  life-to-first-crack  is  not  a fixed  fraction 
of  the  dysfunction  life  and  consequently  an  inconsistent  level  of  safety  results.  Additionally,  it  is  found 
that  minor  cycles  are  usually  more  damaging  in  crack  propagation  than  they  are  during  life-to-first-crack. 
All  these  issues  have  important  consequences  for  the  implementation  of  a safe  life,  ltfc  lifing  policy. 
They  have  even  greater  significance  for  damage  tolerance  approaches. 

Another  aspect  that  has  to  be  addressed  is  that  in  current  methodologies  little  consideration  is  given  to 
rate  of  increase  in  risk  with  increased  component  service  life  and  hence  these  traditional  approaches  do 
not  always  provide  the  required  statistical  information  for  the  managed  withdrawal  of  service 
components.  Current  methods  do  not  allow  exploitation  of  the  full  life  capability  of  components  with  long 
crack  propagation  lives. 

Although  the  pscl  methodology  can  loosely  be  considered  to  be  a form  of  risk  model,  it  is  not  sufficiently 
flexible  to  handle  the  wide  variety  of  issues  that  arise  in  service.  Indeed,  when  a significant  downward 
life  reduction  occurs,  strict  implementation  of  the  safe  life  criterion  could  result  resulted  in  the  grounding 
of  aircraft  fleets.  Hence,  within  the  context  of  airworthiness,  it  is  now  proposed  that  safety  should  be 
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related  to  the  predicted  dysfunction  distribution  and  safety  factors  associated  with  ‘95%  confidence,  1 -in- 
750’  should  be  replaced  by  the  determination  of  maximum  risk  levels  (e.g.  for  components  a reasonable 
level  might  be  set  at  10‘8  per  engine  flying  hour). 

To  address  these  diverse  issues  it  is  strongly  advocated  that  there  should  be  a move  towards  the 
development  and  adoption  of  a more  robust  risk  based  life  assessment  methodology.  Such  an  approach 
should  include  the  identification  of  the  component  life-to-first-crack  and  propagation  life  distributions 
and  account  for  all  factors  that  affect  them  (inspection,  fabrication  knowledge  etc.).  These  distributions 
should  then  be  combined  to  obtain  the  estimated  dysfunction  distribution,  whilst  taking  full  account  of 
sampling  error.  This  should  allow  the  instantaneous  risk/hour  to  be  derived  from  the  estimated 
dysfunction  distribution  and  hence  allow  the  safety  criteria  to  be  defined  in  terms  of  risk. 


Useful  management  parameters  available  from  such  an  approach  include  the  identification  of  an 
individual  aircraft  peak  risk/hour  by  which  time  components  must  be  inspected  or  else  retired  and  also 
identification  of  a maximum  fleet  cumulative  risk  per  annum.  It  should  then  be  possible  to  correlate  the 
identified  risk  to  other  available  management  tools  such  as  the  RAF  Hazard  Risk  Index. 

5.2  Identification  of  the  component  distributions 

For  aeroengine  discs,  the  lives-to-first-crack  form  an  approximate  lognormal  distribution.  The  associated 
probability  density  function  can  be  expressed  as 
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where  ‘ErP  is  the  mathematical  error  function,  ‘Nu  is  the  life-to-first-crack  (cycles)  of  a given 
component,  ' N'  ' is  the  log-mean  of  the  Itfc  distribution  and  ‘sf‘  is  the  scatter  factor  of  the  ltfc 

distribution.  By  replacing  the  occurrences  of  the  superscript  ‘i*  with  the  superscript  ‘p\  a propagation  life 
distribution  is  described.  Similarly  by  replacing  the  superscript  ‘i’  by  the  superscript  ‘d’,  a dysfunction 
distribution  is  defined. 


5.3  Estimation  of  the  dysfunction  distribution 

Often  the  limited  available  data  are  such  that  it  is  preferable  to  derive  the  dysfunction  distribution  from 
the  life-to-first-crack  and  propagation  life  distributions  for  the  component.  The  dysfunction  life  ‘Nd‘  is 
equal  to  the  sum  of  its  life-to-first-crack  ‘N”  and  its  propagation  life  ‘Np\ 


Nd  = N‘  + Np 


(9) 


From  a purely  statistical  viewpoint  the  two  extremes  are  that  the  two  component  distributions  are  totally 
dependent  or  they  are  independent  (total  dependence  means  that  a component  with  a long  ltfc  will  have  a 
proportionately  long  propagation  life).  Factors  that  contribute  to  the  net  effect  include  chemical 
composition,  manufacturing  and  machining,  heat  treatment  and  surface  residual  stresses.  The  life-to-first- 
crack  distributions  and  the  propagation  lives  obtained  in  the  nickel-base  superalloys  used  in  aeroengine 
discs  appear  to  exhibit  an  interdependence.  That  is  they  are  partly  dependent  and  partly  independent. 
Current  evidence  indicates  that  assuming  50-50  dependence-independence  is  conservative.  Although  the 
degree  of  interdependence  does  not  affect  the  geometric  mean  of  the  dysfunction  distribution  and  it  has  a 
relatively  minor  effect  on  the  distribution  form,  it  has  a significant  effect  on  the  dysfunction  scatter  factor 
as  illustrated  in  Table  4. 
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Individual  SF 

Combined  Scatter  Factors 

Nature  of  component 

ltfc 

Prop. 

Dependent 

Dysfunction 

Independent 

Dysfunction 

50% 

Dependent 

Typical  (N^OJN1) 

6 

| 

5.6 

4.4 

5.0 

Surface  sensitive  (NP=0.5N') 

10 

4 

8.6 

5.8 

7.2 

Crack  Tolerant  (NP=2N') 

6 

m 

5.0 

2.9 

3.9 

Crack  Tolerant  (NP=2N‘)  but 
surface  sensitive 

10 

4 

6.6 

3.2 

Table  4.  Influence  of  initiation  to  propagation  life  ratio , and  initiation  scatter  on  the  combined  scatter 
factors 


5.4  Estimation  of  the  dysfunction  distribution  subject  to  inspection  (Effect  of  inspection  on 
remnant  dysfunction  distribution) 

If  a component  is  subject  to  inspection,  then  a dysfunction  distribution  can  to  be  calculated  for  each 
inspection  interval.  Until  the  first  inspection  occurs  the  dysfunction  distribution  is  derived  as  described 
above.  For  the  second  inspection  interval,  suppose  that  the  probability  of  detection  is  ‘POD’.  Then 
POD*  100%  of  the  life-to-first-crack  distribution  is  truncated  and  100(1-POD)%  is  not  truncated.  The 
effective  life-to-first-crack  distribution  is  thus  given  by  the  following  expression. 

PD’  - POD. PD' [truncated]  + (1  - POD).PD'[not  truncated ] ( 1 0) 

The  modified  life-to-first-crack  distribution  can  then  be  combined  with  the  propagation  life  distribution  to 
obtain  the  dysfunction  distribution  using  the  approach  described  in  the  previous  section.  For  simplicity, 
in  the  results  to  be  presented  later,  100%  independence  has  been  assumed.  Numerical  methods  can  be 
used  to  evaluate  the  required  convolution  integral. 

Assuming  100%  detection  of  all  cracks  exceeding  0.38mm  surface  length,  inspection  at  ‘n’  cycles  can  be 
represented  by  a sharp  truncation  of  the  life-to-first-crack  distribution  at  that  point.  Figure  2 shows  the 
effect  of  inspection  on  the  ltfc  density  distribution.  (For  the  case  shown,  the  geometric  mean  initiation 
life  is  10,000  cycles  and  scatter  factor  (defined  as  the  ratio  between  the  plus  and  minus  3o  quantiles)  has 
a value  of ‘6’. 


1 x 10^ 

„ . ....,  8 x 10‘5 

Probability 

Density  6xl0'5 

4 x 10'5 

2 x 10'5 

5,000  10,000  15,000  20,000  25,000 

Reference  Cycles 

Figure  2.  Truncated  life-to-first-crack  distribution  (representative  of  perfect  inspection. 
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If  crack  detection  is  perfect  prior  inspections  are  irrelevant  because  the  current  inspection  detects  any 
crack  missed  by  a previous  inspection.  If  no  cracks  are  detected,  then  the  risk  curve  associated  with  the 
previous  inspection  applies.  Thus  the  risk  curve  for  a subsequent  inspection  ‘i’  can  be  expressed  as 

R,[efh\  = PODxRp[efh]  + (1  - POD)xRi_ , [efh]  (1 1) 


An  imperfect  inspection  can  be  represented  as  a mix  of  the  truncated  and  non-truncated  life-to-first-crack 
distributions. 


5.5  Determination  of  instantaneous  risk  per  flight  hour 

This  section  presents  a model  for  determining  individual  aircraft  dysfunction  risk  per  aircraft  flying  hour 
and  then  indicates  how  the  cumulative  risk  can  be  expressed  via  an  integral  form  of  this  equation.  Since  in-_ 
UK,  most  of  the  service  components  are  lifed  according  to  the  PSCL  approach  describecf  earlier,  the 
following  risk  model  is  expressed  in  terms  of  the  safe  service  life  ‘Ar’  since  originally,  the  risk  equation 
was  developed  to  allow  management  of  components  operating  beyond  their  declared  life,  Ar. 

The  initial  stage  in  the  assessment  therefore  quantifies  the  safety  factors  associated  with  Ar.  A procedure 
for  determining  the  safety  factor  ‘y\  associated  with  a component  that  has  reached  its  safe  service  life, 
Ar,  was  discussed.  This  factor  is  with  respect  to  the  crack  initiation  distribution  and  when  related  to  burst 
a further  factor  has  to  be  applied.  In  the  absence  of  onboard  usage  recorders,  service  lives  are  expressed  in 
terms  of  hours  and  mission  exchange  rates  are  used  to  convert  these  hours  into  reference  cycles.  For  the 
typical  case  illustrated  previously  where  the  mean  of  the  burst  distribution  is  a factor  of  1.5  times  the 
mean  ltfc,  exchange  rates  for  initiation  and  for  propagation  are  based  on  different  criteria  and  typically 
propagation  rates  are  about  a factor  of  2.5  times  initiation  rates.  This  correlation  allows  propagation 
cycles  to  be  converted  to  equivalent  initiation  cycles  and  hence  allows  the  application  of  a single 
exchange  rate  to  risk  assessments.  The  propagation  cycles  can  be  converted  into  equivalent  available 
initiation  cycles  by  dividing  them  by  the  factor  of  ‘2.5’  thus,  to  relate  the  safety  factor  ‘y’  to  the  burst 
distribution  it  has  to  be  modified  by  the  ratio  ‘1.2’  (=l+0.5/2.5).  For  any  other  service  life  in  hours,  the 
additional  safety  factor  can  be  related  to  the  safety  factor  at  Ar  through  the  multiplication  factor  Ar/(H.p’). 
Hence 


Ar  (' 

S=V. = 1.2  x 2.449  x 6^  Av"J 

' hj3 


f A \ 

Ar 

\//x  A , 


(12) 


where  H is  the  component  life  in  hours. 

The  risk  per  engine  flying  hour  is  defined  as  the  rate  of  increase  of  probability  of  failure  with  respect  to  ' 
increased  engine  flying  hours.  * 


risk  / efh  = 


dH 


(13) 


To  simplify  the  derivation,  the  assumed  lognormal  dysfunction  distribution  is  transformed  to  a Gaussian 
distribution  and  to  map  the  fatigue  lives  of  the  test  results  to  the  transformed  distribution,  the  logarithm  of 
their  values  is  taken.  Since  it  is  easier  to  consider  the  risk  in  terms  of  the  rate  of  increase  of  the 
transformed  variable  8S'  (i.e.  log  S),  the  following  partial  derivative  is  used: 


risk!  efh 


d{p(  fail)}  _ dS' 
AS'  X dH 


d{p(  fail)} 
dS'  H 


(14) 


For  the  artificial  case  of  an  infinite  sample  of  component  test  results,  there  would  be  no  sampling  error.  In 
this  case,  the  location  of  the  component  service  life  relative  to  the  GM  of  the  burst  distribution  would  be 
precisely  determined  as  shown  in  Figure  3.  Therefore,  the  risk  per  engine  flying  hour  (risk/efh)  is  simply 
equal  to  the  shaded  area  in  the  figure. 
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Figure  3.  Illustration  of  the  risk  assessment  model  for  the  case  where  the  geometric  mean  of  the 
population  burst  distribution  is  known. 

In  current  UK  lifing  procedures,  for  fracture  critical  components  both  the  form  and  the  scatter  of  the 
population  burst  distribution  are  assumed  to  be  identified  [4],  A consequence  of  these  assumptions  is 
that,  given  a (known)  failure  distribution  of  an  infinite  population,  each  result  can  be  considered  as  the 
mean  of  a sample  of  one.  If  groups  of  samples  of  2,  3,  4...n  are  randomly  selected  from  the  total 
population,  the  means  of  the  individual  samples  of  size  ‘n’  will  also  have  a known  distribution.  Hence,  a 
single  component  test  sample  of  size  ‘n’  will  have  a known  error  band  associated  with  its  use  in  the 
estimation  of  the  mean  of  the  total  population.  This  is  particularly  important  in  risk  analysis  since  the 
location  of  the  population  mean  solely  from  the  mean  of  the  sample  and  without  consideration  of 
sampling  error  can  lead  to  an  under-prediction  of  the  ‘best  estimate’  of  the  risks  associated  with 
individual  service  components.  The  sampling  error  x\  is  equal  to  the  difference  between  the  sample  GM 
and  the  population  GM.  In  other  words,  since  the  population  mean  life  has  been  determined  from  the  test 
sample  mean  life,  the  location  of  a component  service  life  relative  to  the  burst  distribution  is  not  precisely 
identified.  Equally,  the  analysis  can  be  considered  from  the  viewpoint  of  an  error  in  the  service 
component  life  location  relative  to  a fixed  dysfunction  distribution.  This  approach  yields  identical  risk 
values  as  obtained  with  the  assumption  of  dysfunction  distribution  error,  but  is  simpler  to  illustrate. 
Figure  4. 

It  follows  that  for  a specified  service  life  and  its  associated  sampling  error,  x',  the  risk/efh  is  equal  to  the 
integral  of  the  probability  of  burst  distribution  over  the  interval  (efh)  to  (efh+1 ).  The  total  risk/efh  is  now 
the  summation,  or  the  integral  of  these  risks  multiplied  by  the  probability  that  the  sampling  error  is  x'. 
Hence,  to  account  for  the  sampling  error  x',  the  risk/efh  is  equal  to  the  integral  of  the  risk/efh  given  the 
location  x'  of  the  sample  mean  on  the  sampling  distribution,  times  the  probability  of  the  sample  mean 
being  located  at  x'  on  the  sampling  distribution.  Since  the  probability  density  function  for  the  sampling 
error  x'  can  be  determined,  then  the  following  standard  statistical  equation  can  be  used  to  solve  the  risk 
/efh. 


P(y)  = jP(y  | x').PD{x').d  x'  (15) 


where  ‘y’  is  the  risk/efh.  The  solving  of  the  above  equations  to  give  an  expression  in  terms  of  risk  levels 
associated  with  individual  life  expired  discs  is  explained  elsewhere  [4].  Equation  16  is  a basic  form  of 
this  solution  which  has  been  used  in  some  recent  risk  assessments. 


d(risk)  1.5 
d(H)  H } 
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- 1.0782  - 


0.49094 


fn 


(16) 
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where  ‘H’  is  the  life  of  the  component  service  life  in  efh  and  ‘n’  is  the  component  test  sample  size. 


Error  distribution  PDs(?c')  of 
where  component  life  may 
lie  relative  to  GM  of  burst 
distribution  - resulting  from 
component  test  sampling 


GM  burst  life  of  test 
sample 

/ 


Area  = risk/efh  given  x*! 
— PDb(x-s’)  j 


Population  burst 
distribution(PDb) 


Efh  relative  to  burst 
distribution  flop  scale) 


This  area  is  equal  to  the  risk/efh, 
taking  into  account  the  disc  test 
sampling  error 
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Figure  4.  Incorporation  of  disc  sampling  error  into  risk  assessment 
5.6  Risk  based  managed  withdrawal  of  over-Iifed  parts 

From  an  operational  perspective,  two  of  the  most  useful  measures  of  the  risk  of  fatigue  failure  of  fracture- 
critical  components  are  a)  individual  aircraft  instantaneous  risk  per  flight  hour,  and  b)  fleet  cumulative 
risk  per  annum  (or  other  suitable  management  period). 

5.6.1  Individual  aircraft  instantaneous  risk  of  fatigue  per  flight  hour 

As  components  are  exposed  to  continued  service  usage,  the  instantaneous  risk  of  failure  increases  at  a 
highly  non-linear  rate.  A consequence  of  this  is  that,  in  the  event  of  an  unforeseen  component  life 
reduction,  service  engines  may  suddenly  have  life-expired  parts  and  the  operator  needs  to  know  the  risks 
that  leading  parts  are  incurring.  Hence,  for  example,  in  a recent  service  case,  the  original  declared  safe 
service  life  of  10,000  cycles  was  calculated  from  a test  sample  of  3.  With  a cyclic  exchange  rate  of  2.0,  at 
the  full  declared  ltfc,  Ar,  substitution  into  equation  16  gives  an  estimated  risk/efh  of  2.8x10  s.  A 
subsequent  requirement  reduced  the  declared  safe  service  life  of  the  component  by  20%,  to  8,000  cycles. 
However,  at  the  original  life  of  10,000  cycles,  the  risk  carried  by  such  a component  has  now  risen  to 
2.1xl0‘7/efh.  And  hence  for  an  individual  disc  close  to  the  old  service  life,  if  this  level  of  risk  is  deemed 
acceptable,  then  such  a service  life  could  be  maintained  for  a limited  period  whilst  replacement  parts  are 
procured. 

An  illustration  of  the  form  in  of  results  obtained  from  a risk  analysis  of  a typical  aeroengine  component, 
are  illustrated  in  Table  5 (in  this  case  the  safe  service  life,  Ar,  equals  5,200  cycles).  The  table  provides 
the  calculated  risk  per  efh  at  the  service  life  for  the  component  and  provides  estimates  of  the  ‘available’ 
additional  service  hours  until  the  operating  risks  reach  the  identified  levels. 
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Total  cycles 

Cycles  over  PSCL 

Additional  Efh 

Risk/efh/engine 

5,201 

0 

0 

7x1  O'8 

5,344 

143 

44 

lxlO7 

5,828 

627 

194 

3x1  O'7 

6,464 

1,263 

391 

lxlO'6 

Table  5.  Estimated  lives  corresponding  to  specified  risk  level/efh/ettgine  using  a sample  size  of  5,  and 
a mission  exchange  rate  equal  to  3.  (Propagation  rates  have  been  assumed  to  be  2.5  times  initiation). 


5.6.2  Effect  of  Fixed  Inspection  Intervals 

In  both  Damage  Tolerance  and  Retirement  for  Cause  life  assessment  methods,  inspection  is  perceived  to 
be  the  essential  parameter  that  underpins  safety.  A detection  limit  is  set  such  that  to  95%  confidence 
there  is  a 90%  probability  that  cracks  of  the  maximum  specified  size  will  be  detected  if  present.  Using 
this  crack  size  as  the  input  parameter  for  finite  element  crack  growth  analysis,  the  allowable  inspection 
interval  is  then  set  at  50%  of  the  calculated  mean  crack  growth  life.  It  is  asserted  that  the  procedure  has  a 
built-in  safety  in  that  should  a crack  be  missed  a further  inspection  will  have  occurred  prior  to 
dysfunction. 

The  above  illustrations  although  strictly  accurate  do  not  reflect  the  true  safety  levels  associated  with 
damage  tolerance.  Indeed  safety  comes  from  the  fact  that  extremely  few  parts  are  likely  to  be  cracked  at 
the  specified  inspection  interval  (although  for  high  strength  materials  severe  quenching,  etc.  can  crack 
inherent  defects  at  the  microscopic  level).  Given  either  case,  damage  tolerance  does  not  optimise  the 
inspection  interval.  For  conventional  superalloys,  the  ltfc  approach  has  demonstrated  that  typically  the 
dysfunction  life  is  50%  above  ltfc.  Assuming  a crack  initiation  size  of  0.38  mm  as  a realistic  level  at 
which  cracks  will  not  be  missed,  wide  European  experience  indicates  that  exchange  rates  for  growth 
beyond  the  0.38mm  size  are  not  less  than  a factor  of  2.5  greater  the  rates  up  to  this  crack  size. 

In  a damage  tolerance  context,  the  inspection  interval  would  normally  be  based  half  the  crack  growth  life, 
that  is  25%  of  the  initiation  life.  However,  since  a crack  growth  mission  exchange  rate  has  to  be 
assumed,  this  25%  in  cycles  translates  to  only  10%  in  equivalent  service  hours  that  can  be  flown.  It 
follows  that  under  damage  tolerance  a disc  could  be  inspected  up  to  10  times  prior  to  it  reaching  the 
European  predicted  safe  cyclic  life. 

Specifically  with  regard  to  retirement  for  cause  and  set  inspection  intervals.  Figure  5 illustrates  the 
increased  risk  associated  with  running  all  components  until  cracks  are  identified.  In  this  example,  the 
inspection  interval  has  been  set  at  half  the  propagation  life.  Inspections  1-3  are  unnecessary  and 
inspections  5-7  are  too  infrequent  to  ensure  acceptable  risk  management. 

4 b £.'  /■ 


Life  consumed  (cycles) 

Figure  5.  This  is  the  effect  of  set  inspection  intervals  on  component  service  risk 
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5.6.3  Risk  governed  inspection  intervals 

An  extension  of  the  risk  model  allows  new  components  to  be  left  in  service  until  the  dysfunction  risk/ 
reaches  a specified  limit.  At  this  point  component  inspection  is  used  to  reduce  the  risk  of  failure.  The 
model  is  again  used  to  predict  the  dysfunction  risk  during  subsequent  service  and  hence  the  life  extension 
prior  to  the  set  risk  level  being  reached  and  the  service  intervals  for  all  subsequent  inspections.  Figure  6 
shows  that  the  safe  inspection  intervals  get  progressively  shorter  until  the  life  extension  falls  below  a 
minimum  economical  viable  service  life.  Although  significant  life  extension  beyond  the  pscl  may  be 
obtained  using  this  approach  while  still  ensuring  that  the  risk  of  LCF  failure  does  not  exceed  the  specified 
level,  the  major  benefit  comes  from  identifying  a safe  service  life  beyond  which  retirement  for  cause 
would  be  unsafe.  Hence  the  approach  automatically  sets  an  economic  limit  for  retirement  for  cause  but 
avoids  the  progressive  risk  levels  associated  with  its  current  embodiment. 


Figure  6.  Prediction  of  the  risk  associated  with  application  of  Risk  Based  Damage  Tolerance. 
Inspection  intervals  set  to  keep  to  remain  within  a set  risk  level  of  Iff7  per  efh.  (Note  the  long  interval 
before  inspection  1 and  that  the  PSCL/fiin  this  example  is  2,880  efh). 


6 FINAL  COMMENTS 

The  paper  has  briefly  summarised  the  common  life  assessment  procedures  for  fracture  critical  parts.  A 
procedure  which  allows  the  maximum  benefit  to  be  extracted  from  non-finite  fatigue  results  whilst  still 
maintaining  safety.  The  application  of  risk  based  life  assessment  methods  have  been  shown  to  provide 
more  consistent  levels  of  safety  than  standard  procedures.  The  approach  also  enables  the  risks  associated 
with  the  continued  running  of  life-expired  parts  and  enables  informed  management  decisions  to  be  taken. 
The  model  has  significant  potential  for  application  within  damage  tolerance  fifing  procedures  and  should 
allow  inspection  intervals  to  be  set  on  the  basis  of  defined  risk  -levels.  In  this  context  the  approach 
automatically  sets  an  economic  limit  for  retirement  for  cause  but  avoids  the  progressive  risk  levels 
associated  with  its  current  embodiment. 
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